fix(deps): update dependency execa to v8 (#2914)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.git-blame-ignore-revs

@@ -1,2 +1,4 @@
 # style: prettier (#2670)
-b06c9bbe4c6be121c5561b356d8c465c1cadffba
+b06c9bbe4c6be121c5561b356d8c465c1cadffba
+# style: upgraded prettier to v3 (#2863)
+272af210523804de782b3076f05e56bcb4aeeb8f

.github/workflows/release.yml

@@ -18,8 +18,8 @@ jobs:
     name: release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
-      - uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
+      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3
         with:
           cache: npm
           node-version: lts/*

.github/workflows/scorecard.yml

@@ -0,0 +1,36 @@
+name: OpenSSF Scorecard
+"on":
+  schedule:
+    - cron: 31 2 * * 1
+  push:
+    branches:
+      - master
+permissions: read-all
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
+      - name: Run analysis
+        uses: ossf/scorecard-action@08b4669551908b1024bb425080c797723083c031 # v2.2.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - name: Upload artifact
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+      - name: Upload to code-scanning
+        uses: github/codeql-action/upload-sarif@a09933a12a80f87b87005513f0abb1494c27a716 # v2.21.4
+        with:
+          sarif_file: results.sarif

.github/workflows/test.yml

@@ -27,11 +27,11 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
       - run: git config --global user.name github-actions
       - run: git config --global user.email github-actions@github.com
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3
+        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
@@ -46,8 +46,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: test_matrix
     steps:
-      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
-      - uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
+      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3
         with:
           node-version: lts/*
           cache: npm

LICENSE

@@ -9,8 +9,8 @@ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

README.md

@@ -7,6 +7,9 @@
   <a href="https://github.com/semantic-release/semantic-release/actions?query=workflow%3ATest+branch%3Amaster">
     <img alt="Build states" src="https://github.com/semantic-release/semantic-release/workflows/Test/badge.svg">
   </a>
+  <a href="https://securityscorecards.dev/viewer/?uri=github.com/semantic-release/semantic-release">
+    <img alt="OpenSSF Scorecard" src="https://api.securityscorecards.dev/projects/github.com/semantic-release/semantic-release/badge">
+  </a>
   <a href="#badge">
     <img alt="semantic-release: angular" src="https://img.shields.io/badge/semantic--release-angular-e10079?logo=semantic-release">
   </a>

docs/extending/plugins-list.md

@@ -107,7 +107,7 @@
   - `verifyConditions`: Verify the presence and the validity of the authentication and the assets option configuration.
   - `publish`: Publish a Gitea release, optionally uploading file assets.
   - `addChannel`: Update a Gitea release's pre-release field.
-- [@google/semantic-release-replace-plugin](https://github.com/google/semantic-release-replace-plugin)
+- [semantic-release-replace-plugin](https://github.com/jpoehnelt/semantic-release-replace-plugin)
   - `prepare`: Replace version strings in files using regex and glob.
 - [semantic-release-rubygem](https://github.com/Gusto/semantic-release-rubygem)
   - `verifyConditions`: Locate and validate a `.gemspec` file, locate and validate a `lib/**/version.rb` file, verify the presence of the `GEM_HOST_API_KEY` environment variable, and create a credentials file with the API key.

lib/get-last-release.js

@@ -30,7 +30,11 @@ export default ({ branch, options: { tagFormat } }, { before } = {}) => {
   const [{ version, gitTag, channels } = {}] = branch.tags
     .filter(
       (tag) =>
-        ((branch.type === "prerelease" && tag.channels.some((channel) => isSameChannel(branch.channel, channel))) ||
+        ((branch.type === "prerelease" &&
+          tag.channels.some((channel) => isSameChannel(branch.channel, channel)) &&
+          semver
+            .parse(tag.version)
+            .prerelease.includes(branch.prerelease === true ? branch.name : branch.prerelease)) ||
           !semver.prerelease(tag.version)) &&
         (isUndefined(before) || semver.lt(tag.version, before))
     )

package.json

@@ -26,16 +26,16 @@
     "Matt Travi <npm@travi.org> (https://matt.travi.org/)"
   ],
   "dependencies": {
-    "@semantic-release/commit-analyzer": "^10.0.0-beta.1",
-    "@semantic-release/error": "^3.0.0",
-    "@semantic-release/github": "9.0.0-beta.2",
+    "@semantic-release/commit-analyzer": "^10.0.0",
+    "@semantic-release/error": "^4.0.0",
+    "@semantic-release/github": "^9.0.0",
     "@semantic-release/npm": "^10.0.2",
     "@semantic-release/release-notes-generator": "^11.0.0",
     "aggregate-error": "^4.0.1",
     "cosmiconfig": "^8.0.0",
     "debug": "^4.0.0",
     "env-ci": "^9.0.0",
-    "execa": "^7.0.0",
+    "execa": "^8.0.0",
     "figures": "^5.0.0",
     "find-versions": "^5.1.0",
     "get-stream": "^6.0.0",
@@ -43,12 +43,12 @@
     "hook-std": "^3.0.0",
     "hosted-git-info": "^6.0.0",
     "lodash-es": "^4.17.21",
-    "marked": "^4.1.0",
+    "marked": "^5.0.0",
     "marked-terminal": "^5.1.1",
     "micromatch": "^4.0.2",
     "p-each-series": "^3.0.0",
     "p-reduce": "^3.0.0",
-    "read-pkg-up": "^9.1.0",
+    "read-pkg-up": "^10.0.0",
     "resolve-from": "^5.0.0",
     "semver": "^7.3.2",
     "semver-diff": "^4.0.0",
@@ -56,22 +56,22 @@
     "yargs": "^17.5.1"
   },
   "devDependencies": {
-    "ava": "5.2.0",
-    "c8": "7.14.0",
+    "ava": "5.3.1",
+    "c8": "8.0.1",
     "clear-module": "4.1.2",
     "codecov": "3.8.3",
     "dockerode": "3.3.5",
     "file-url": "4.0.0",
     "fs-extra": "11.1.1",
-    "got": "12.6.0",
+    "got": "13.0.0",
     "js-yaml": "4.1.0",
     "mockserver-client": "5.15.0",
-    "nock": "13.3.1",
+    "nock": "13.3.3",
     "p-retry": "5.1.2",
-    "prettier": "2.8.8",
-    "sinon": "15.1.0",
+    "prettier": "3.0.2",
+    "sinon": "15.2.0",
     "stream-buffers": "3.0.2",
-    "tempy": "3.0.0",
+    "tempy": "3.1.0",
     "testdouble": "3.18.0"
   },
   "engines": {

test/get-last-release.test.js

@@ -43,6 +43,43 @@ test("Get the highest prerelease valid tag, ignoring other tags from other prere
   });
 });
 
+test("Get the correct prerelease tag, when other prereleases share the same git HEAD", (t) => {
+  const testConfig = {
+    branch: {
+      name: "alpha",
+      prerelease: "alpha",
+      channel: "alpha",
+      tags: [
+        { version: "1.0.0-beta.1", gitTag: "v1.0.0-beta.1", gitHead: "v1.0.0-beta.1", channels: ["beta"] },
+        { version: "1.0.0-beta.2", gitTag: "v1.0.0-beta.2", gitHead: "v1.0.0-alpha.1", channels: ["alpha", "beta"] },
+        { version: "1.0.0-alpha.1", gitTag: "v1.0.0-alpha.1", gitHead: "v1.0.0-alpha.1", channels: ["alpha", "beta"] },
+      ],
+      type: "prerelease",
+    },
+    options: { tagFormat: `v\${version}`, debug: true },
+  };
+  const firstResult = getLastRelease(testConfig);
+
+  t.deepEqual(firstResult, {
+    version: "1.0.0-alpha.1",
+    gitTag: "v1.0.0-alpha.1",
+    name: "v1.0.0-alpha.1",
+    gitHead: "v1.0.0-alpha.1",
+    channels: ["alpha", "beta"],
+  });
+
+  testConfig.branch.prerelease = true;
+  const secondResult = getLastRelease(testConfig);
+
+  t.deepEqual(secondResult, {
+    version: "1.0.0-alpha.1",
+    gitTag: "v1.0.0-alpha.1",
+    name: "v1.0.0-alpha.1",
+    gitHead: "v1.0.0-alpha.1",
+    channels: ["alpha", "beta"],
+  });
+});
+
 test("Return empty object if no valid tag is found", (t) => {
   const result = getLastRelease({
     branch: {

test/get-next-version.test.js

@@ -275,3 +275,24 @@ test("Increase version for release on prerelease branch when there is no regular
     "1.0.0-beta.2"
   );
 });
+
+test("Increase patch when previous version shares HEAD with other releases", (t) => {
+  t.is(
+    getNextVersion({
+      branch: {
+        name: "alpha",
+        type: "prerelease",
+        prerelease: "alpha",
+        tags: [
+          { gitTag: "v1.0.0-beta.1", version: "1.0.0-beta.1", channels: ["beta"] },
+          { gitTag: "v1.0.0-beta.2", version: "1.0.0-beta.2", channels: ["alpha", "beta"] },
+          { gitTag: "v1.0.0-alpha.1", version: "1.0.0-alpha.1", channels: ["alpha", "beta"] },
+        ],
+      },
+      nextRelease: { type: "patch", channel: "alpha" },
+      lastRelease: { version: "v1.0.0-alpha.1", channels: ["alpha", "beta"] },
+      logger: t.context.logger,
+    }),
+    "1.0.0-alpha.2"
+  );
+});

test/helpers/git-utils.js

@@ -90,9 +90,7 @@ export async function gitCommits(messages, execaOptions) {
   await pEachSeries(
     messages,
     async (message) =>
-      (
-        await execa("git", ["commit", "-m", message, "--allow-empty", "--no-gpg-sign"], execaOptions)
-      ).stdout
+      (await execa("git", ["commit", "-m", message, "--allow-empty", "--no-gpg-sign"], execaOptions)).stdout
   );
   return (await gitGetCommits(undefined, execaOptions)).slice(0, messages.length);
 }

test/helpers/gitbox.js

@@ -1,5 +1,4 @@
 import Docker from "dockerode";
-import getStream from "get-stream";
 import pRetry from "p-retry";
 import { gitShallowClone, initBareRepo } from "./git-utils.js";
 
@@ -15,11 +14,20 @@ let container;
 export const gitCredential = `${GIT_USERNAME}:${GIT_PASSWORD}`;
 
 /**
- * Download the `gitbox` Docker image, create a new container and start it.
+ * Download the `gitbox` Docker image
+ */
+export function pull() {
+  return docker.pull(IMAGE).then((stream) => {
+    return new Promise((resolve, reject) => {
+      docker.modem.followProgress(stream, (err, res) => (err ? reject(err) : resolve(res)));
+    });
+  });
+}
+
+/**
+ * create a new container and start it.
  */
 export async function start() {
-  await getStream(await docker.pull(IMAGE));
-
   container = await docker.createContainer({
     Tty: true,
     Image: IMAGE,

test/helpers/mockserver.js

@@ -1,5 +1,4 @@
 import Docker from "dockerode";
-import getStream from "get-stream";
 import got from "got";
 import pRetry from "p-retry";
 import { mockServerClient } from "mockserver-client";
@@ -11,11 +10,20 @@ const docker = new Docker();
 let container;
 
 /**
- * Download the `mockserver` Docker image, create a new container and start it.
+ * Download the `mockserver` Docker image,
+ */
+export function pull() {
+  return docker.pull(IMAGE).then((stream) => {
+    return new Promise((resolve, reject) => {
+      docker.modem.followProgress(stream, (err, res) => (err ? reject(err) : resolve(res)));
+    });
+  });
+}
+
+/**
+ * create a new container and start it.
  */
 export async function start() {
-  await getStream(await docker.pull(IMAGE));
-
   container = await docker.createContainer({
     Tty: true,
     Image: IMAGE,

test/helpers/npm-registry.js

@@ -2,7 +2,6 @@ import path, { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { setTimeout } from "node:timers/promises";
 import Docker from "dockerode";
-import getStream from "get-stream";
 import got from "got";
 import pRetry from "p-retry";
 
@@ -17,11 +16,20 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 let container, npmToken;
 
 /**
- * Download the `npm-registry-docker` Docker image, create a new container and start it.
+ * Download the `npm-registry-docker` Docker image
+ */
+export function pull() {
+  return docker.pull(IMAGE).then((stream) => {
+    return new Promise((resolve, reject) => {
+      docker.modem.followProgress(stream, (err, res) => (err ? reject(err) : resolve(res)));
+    });
+  });
+}
+
+/**
+ * create a new container and start it.
  */
 export async function start() {
-  await getStream(await docker.pull(IMAGE));
-
   container = await docker.createContainer({
     Tty: true,
     Image: IMAGE,

test/index.test.js

@@ -1853,10 +1853,19 @@ test.serial("Throw an Error if plugin returns an unexpected value", async (t) =>
   await td.replaceEsm("../lib/get-logger.js", null, () => t.context.logger);
   await td.replaceEsm("env-ci", null, () => ({ isCi: true, branch: "master", isPr: false }));
   const semanticRelease = (await import("../index.js")).default;
-  const error = await t.throwsAsync(
-    semanticRelease(options, { cwd, env: {}, stdout: new WritableStreamBuffer(), stderr: new WritableStreamBuffer() }),
-    { instanceOf: SemanticReleaseError }
-  );
+
+  let error;
+  try {
+    await semanticRelease(options, {
+      cwd,
+      env: {},
+      stdout: new WritableStreamBuffer(),
+      stderr: new WritableStreamBuffer(),
+    });
+  } catch (e) {
+    error = e;
+  }
+  t.is(error.code, "EANALYZECOMMITSOUTPUT");
   t.regex(error.details, /string/);
 });
 

test/integration.test.js

@@ -47,6 +47,7 @@ const pluginLogEnv = path.resolve("./test/fixtures/plugin-log-env");
 const pluginEsmNamedExports = path.resolve("./test/fixtures/plugin-esm-named-exports");
 
 test.before(async () => {
+  await Promise.all([gitbox.pull(), npmRegistry.pull(), mockServer.pull()]);
   await Promise.all([gitbox.start(), npmRegistry.start(), mockServer.start()]);
 
   env = {